Issue 2006 1 March 2006
Total Page:16
File Type:pdf, Size:1020Kb
Issue 2006-1 FACS March 2006 A F~v1E C A AClvi l F C T . r-:.. MET.H ODS ~> T R· se sc~ rv1 S Z A UM.·L ·IFMSI·G E E E E E The Newsletter of the Formal Aspects of Computing Science (FACS) Specialist Group. ISSN 0950-1231 '- I·~, FACS FACTS Issue 2006-1 March 2006 2 FACS FACTS Issue 2006-1 March 2006 Editorial 4 On the Verified-by-Construction Approach 6 Obituary: F _X. Reid 12 .Conference Announcements 15 On the Formal Semantics of the COMEFROM Statement 18 Book Announcement 22 PhD Abstracts 23 FACS Committee 26 3 FACS FACTS Issue 2006-1 March 2006 Welcome to the first Issue of FACS FACTS of 2006. As usual we thank all of the contributors for their support - without them there would be no newsletter. Submissions are always welcome, so please do feel free to contact the editor, Paul Boca [[email protected]. This is a somewhat sombre time for the editorial board of the newsletter, as we have recently learned that F. X. Reid [http://en.wikipedia.org/wiki/F.X.ReidJ. long-term contributor to ttie FACS newsletter, has unexpectedly passed away. An obituary, written by Victor Zemantics, appears on page 12. Reid authored several articles over the years, and has been responsible for "educating" many PhD students as a result. As a tribute to him, we will reprint some of his "gems", starting with an article on the semantics of the COME FROM statement (see page 18). On a happier note, we can report that the FACS Evening Seminars are still proving to be very popular. We began the year with a panel discussion, entitled Formal Methods in the Last 25 Years; more than 70 people attended. The event was organized together with Formal Methods Europe (FME), chaired by John Fitzgerald. We would like to thank FME and the Centre for Software Reliability, University of Newcastle upon Tyne for co-sponsoring the event with FACS. We are hoping to bring you a report on the event in the next issue of the newsletter, together with a reprint of the classic "Magic Roundabout" article. Peter Mosses gave the second seminar in the series this year, entitled Programming Language Description Languages: From Scott and Strachey to Semantics Online. The seminar was attended by almost 40 people - an excellent turnout for a Friday evening. At the time of writing this editorial. we are organizing the third seminar in the series, to be given on 24 April 2006 by Cliff Jones, entitled Specifying Systems that Connect to the Physical World. We expect this to be equally successful, and once again it is an opportunity for people to hear an address from another pioneer in formal methods. The seminar programme for the rest of the year is available on the BCS FACS website [htlp:llwww.bcs-facs.org/events/EveningSeminars1 and in the advertisement on page 14. Slides from previous seminars are available to down load from this website too. We hope you will find the programme of interest and will be able to attend - the seminars are free of charge, funded from membership subscriptions (see page 25 for a membership form). FACS held its AGM on 3 March 2006, and a report on the meeting will appear in a future issue of the newsletter. F ACS welcomes two new committee members: John Derrick (University of Sheffield) to coordinate activities relating to refinement and Mark D'lnverno (University of Westminster) to coordinate model-based specification events (on topics such as B, VDM, Z, etc.). Please do liaise with John or Mark if you are interested in being involved with events in these areas. Unfortunately, FACS has lost two of its officers, AIi Abdallah and Kevin Lano. On behalf of all the members, we would like to thank them for all their efforts over the years. In particular, AIi organized two major and very successful events for F ACS, FASec in 2002 on formal aspects of security and CSP 25 in 2004 to celebrate a quarter of a century of FACS and 4 FACS FACTS Issue 2006-1 March 2006 Communicating Sequential Processes activities. In no small measure, these helped rejuvenate FACS and both proceedings appeared as Springer LNCS volumes. We hope you will enjoy reading the current issue and again encourage you to contribute as well. M! 5 FACS FACTS Issue 2006-1 March 2006 Introduction At the VSTTE (Verified Software: Theories, Tools, Experiments) conference [http://vstte.inf.ethz.chD held in ETH Zurich in October 2005, Tony Hoare and Jay Misra presented a vision of an international Grand Challenge to construct a program verifier. This vision appears to be having a very powerful catalysing effect on getting researchers in all manner of formal development approaches to pool resources and work towards more common goals. This is borne out by the large gathering of top researchers at the VSTTE conference and by the subsequent establishment of working groups set up to refine the challenge further. This article is my attempt at making the case for the so-called verification-by-construction approach to formal development and the contribution it can make to the challenge of verified software. Why verification-by-construction is important Much discussion on the need for a powerful program verifier seems to contain the following underlying assumptions: • That a program verifier will be used mostly to verify programs • That when verification fails it is because the program contains errors While a powerful program verifier is a very valuable tool for programmers, it does not help them construct a verifiable program in the first place. Equally, the quality of any verification is dependent on the validity of the formal properties against which a program is checked. The verification-by-construclion approach helps developers who want to construct reliable software systems by addressing the following questions: • How do we construct properties against which to verify our software? • How do we construct our software so that the verification will succeed? The verification-by-construction approach is about providing design tools that help developers produce reliable software. It broadens the focus away from just being analysis of the finished product and addresses better the development process. How can verification-by-construction be achieved? Verification by construction can be achieved by having a formal framework in which models are constructed at multiple levels of abstraction and related by 6 FACS FACTS Issue 2006-1 March 2006 refinement1 relations_ The highest levels of abstraction are used to express the required behaviour in terms of the problem domain. The closer it is to the problem domain, the easier it is to validate against the informal requirements, i.e., ensure that it is the right specification. The lowest level of abstraction corresponds to an implementation or to a specification from which an efficient implementation can be derived automatically. Also critical in this framework are mechanisms for composing and decomposing models. Composition can be useful for building up specifications by combining models incorporating different requirements. Decomposition is important for relating system models to architectures of subsystem models and subsequent separate refinement of subsystems. Ensuring that two models, M1 and M2, are in a refinement relation may be achieved in one of two ways: 1) Posit-and-Prove: The developer provides both M1 and M2 and uses tools to verify that M1 is refined by M2. In some cases this might be possible using a model checker. Alternatively a tool will generate proof obligations which can be verified using powerful theorem provers or possibly checked using model checkers. Typically this approach requires properties such as invariants and variants to be provided by the developers. 2) Transformational Approach: The developer provides M1 and applies a transformation that automatically constructs M2 in a way that guarantees refinement. This might result in the generation of side conditions that will need to be verified but discharging these should be a lot less effort than proving that M1 is refined by M2 in the posit-and-prove way. One can immediately see how the transformational approach helps developers to construct software such that the verification will succeed. Unfortunately a fully transformational approach for a broad range of problems and solutions is far from being realised so that the posit-and-prove approach will rule for the foreseeable future. It might not appear immediately clear how the posit-and-prove approach helps developers to construct software for which the verification will succeed since the developer is expected to provide M2 as well as M1. This is where having multiple levels of abstraction is important. Typically there is a large abstraction gap between a good formal specification, i.e., one that is easy to validate against the requirements, and an efficient implementation. This gap means it is more difficult to be guided by the specification when constructing an implementation. By having smaller abstraction gaps between a model M1 and its intended refinement M2, it is more natural to be guided by M1 when constructing M2. Typically a refinement step incorporates a design decision about how some effect is achieved or represents an optimization of the design. With a small abstraction gap, the construction of M2 is driven by both M1 and the desired design decision or optimization. When the construction of M2 is guided by M1, then the verification that M2 refines M1 is more likely to succeed. 1 According 10 dictionary.com, '10 refine' means 'to reduce to a pure state'. Ironically our use of the term has the exact opposite meaning. The term 'reify' (as used by Cliff Jones and others) is perhaps more appropriate for what we do but is far less widespread.